Media Library Assistant EUVD-2026-111723

Exploitation requires a victim who is a logged-in Media Library Assistant user holding the Author role or above, who must be tricked into interacting with an attacker-controlled request (UI:R) while their WordPress session is active. The specific trigger is a forged request to the Media Library bulk-action handler that OMITS the CSRF nonce field entirely - because the plugin validates the nonce only when its field is present, a request without the field skips validation. Limiting factors that reduce real-world risk: the targeted account must have Author-level privileges or higher, the session must be authenticated at the time, user interaction is required, and only plugin versions before 3.42 are affected.

This is a moderate, not urgent, issue. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a network-reachable CSRF with integrity-only impact and no confidentiality or availability loss. The signals are internally consistent and point away from mass exploitation: EPSS is 0.11% (1st percentile), there is no CISA KEV listing, and the vuln.today priority label is 'this_month' rather than act_now or emergency. One nuance must be flagged explicitly: CVSS marks PR:N (attacker needs no privileges), which is standard for CSRF because the attacker weaponizes the victim's session - but the description makes clear that exploitation only succeeds if the tricked victim is a logged-in user holding the Author role or above. So while the attacker is unauthenticated, a privileged, authenticated victim and user interaction (UI:R) are both required, which materially narrows the realistic attack surface. The impact is bounded to trashing or deleting media attachments (I:H, A:N), i.e. data loss/manipulation within the Media Library, not code execution or data theft. Overall this is a legitimate medium-priority patch item, not a high-CVSS/low-real-risk false alarm, but the combination of very low EPSS, no KEV, required victim privilege, and required interaction argues against emergency treatment.

An attacker hosts a malicious web page containing a forged request targeting the Media Library Assistant bulk-action handler, deliberately omitting the CSRF nonce field so the plugin's present-only nonce check is bypassed. The attacker lures a logged-in WordPress user with the Author role or above to visit the page while authenticated; the browser submits the forged request and attachments are moved to trash or deleted. No public exploit identified at time of analysis, though the mechanism is described in the WPScan advisory.